EUVD-2026-70991

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

EUVD-2026-70989

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84469

fastify versions before 5.12.2 use JavaScript truthiness to decide whether to compile a request schema. Because JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance, an application that assigns false to a route's body, querystring, params, or headers schema ...

CVE-2026-84469 fastify vulnerable to request validation bypass via skipped boolean false schemas

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-84504

A flaw was found in fastify. An authenticated low-privilege caller can exploit a vulnerability where the framework incorrectly processes the result of an Ajv asynchronous async validator. If a request body contains a root-level property named 'value', fastify replaces the entire request body with...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...

Automated-scanner-CVE-2026-41940

CPANEL CVE EXPLOIT English | فارسی Persian root@kitploit: ██████╗██████╗ █████╗ ███╗ ██╗███████╗██╗ ██╔════╝██╔══██╗██╔══██╗████╗ ██║██╔════╝██║ ██║ ██████╔╝███████║██╔██╗ ██║█████╗ ██║ ██║ ██╔═══╝ ██╔══██║██║╚██╗██║██╔══╝ ██║ ╚██████╗██║ ██║ ██║██║ ╚████║███████╗███████╗ ╚═════╝╚═╝ ╚═╝ ╚═╝╚═╝...

CVE-2026-76169

Fastify (versions >= 4.0.0 and

EUVD-2026-70988

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

CVE-2026-76169 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

cve-2024-4577-phpcgi_rce_reproduction

CVE-2024-4577 - PHP CGI Argument Injection on Windows "WorstFit" Overview CVE-2024-4577 is a critical remote code execution vulnerability in PHP's CGI implementation on Windows. It bypasses the fix for the original CVE-2012-1823 by exploiting Windows "Best-Fit" code page conversion to smuggle...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass CVSS Score: 9.8 Critical Status: Active exploitation in the wild Disclosure: Microsoft August 2025 Patch Tuesday Zero-Day Overview CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protoc...

CVE-2026-81666

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85547

CVE-2026-85547 is a cross-site request forgery (CSRF) vulnerability in MISP (Malware Information Sharing Platform). The root cause is that MISP's _isRest() check disables form-security and CSRF protections when a request is identified as REST, but this detection can be manipulated by an attacker-...

CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2026-85538

An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required permmodify or permmodifyorg permissions. The affected attribute deletion paths relied on organization membership checks performed by...